[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [RFC 09/19] fuzz: use mtree_info to find mapped address
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [RFC 09/19] fuzz: use mtree_info to find mapped addresses |
Date: |
Fri, 26 Jul 2019 23:51:43 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 |
On 26/07/19 15:04, Stefan Hajnoczi wrote:
> On Thu, Jul 25, 2019 at 03:23:51AM +0000, Oleinik, Alexander wrote:
>> Locate mmio and port i/o addresses that are mapped to devices so we can
>> limit the fuzzer to only these addresses. This should be replaced with
>> a sane way of enumaring these memory regions.
>>
>> Signed-off-by: Alexander Oleinik <address@hidden>
>> ---
>> memory.c | 34 ++++++++++++++++++++++++++++++++++
>> 1 file changed, 34 insertions(+)
>>
>> diff --git a/memory.c b/memory.c
>> index 5d8c9a9234..fa6cbe4f1d 100644
>> --- a/memory.c
>> +++ b/memory.c
>> @@ -34,6 +34,11 @@
>> #include "hw/qdev-properties.h"
>> #include "hw/boards.h"
>> #include "migration/vmstate.h"
>> +#ifdef CONFIG_FUZZ
>> +#include "tests/fuzz/fuzz.h"
>> +#include "tests/fuzz/qos_fuzz.h"
>> +#endif
>> +
>>
>> //#define DEBUG_UNASSIGNED
>>
>> @@ -3016,12 +3021,20 @@ static void mtree_print_flatview(gpointer key,
>> gpointer value,
>> int n = view->nr;
>> int i;
>> AddressSpace *as;
>> +#ifdef CONFIG_FUZZ
>> + bool io=false;
>> +#endif
>> +
>>
>> qemu_printf("FlatView #%d\n", fvi->counter);
>> ++fvi->counter;
>>
>> for (i = 0; i < fv_address_spaces->len; ++i) {
>> as = g_array_index(fv_address_spaces, AddressSpace*, i);
>> +#ifdef CONFIG_FUZZ
>> + if(strcmp("I/O",as->name) == 0)
>> + io = true;
>> +#endif
>> qemu_printf(" AS \"%s\", root: %s",
>> as->name, memory_region_name(as->root));
>> if (as->root->alias) {
>> @@ -3062,6 +3075,27 @@ static void mtree_print_flatview(gpointer key,
>> gpointer value,
>> range->readonly ? "rom" : memory_region_type(mr),
>> memory_region_name(mr));
>> }
>> +#ifdef CONFIG_FUZZ
>> + if(strcmp("i/o", memory_region_type(mr))==0 && strcmp("io",
>> memory_region_name(mr))){
>> + fuzz_memory_region *fmr = g_new0(fuzz_memory_region, 1);
>> + if(!fuzz_memory_region_head)
>> + {
>> + fuzz_memory_region_head = fmr;
>> + fuzz_memory_region_tail = fmr;
>> + }
>> + fmr->io = io;
>> + fmr->start = int128_get64(range->addr.start);
>> + fmr->length = MR_SIZE(range->addr.size);
>> + fmr->next = fuzz_memory_region_head;
>> + fuzz_memory_region_tail->next = fmr;
>> + fuzz_memory_region_tail = fmr;
>> + if(io == true){
>> + total_io_mem += MR_SIZE(range->addr.size)+1;
>> + } else {
>> + total_ram_mem += MR_SIZE(range->addr.size)+1;
>> + }
>> + }
>> +#endif
>
> Why is this patch modifying a print function? I think the goal is to
> build the fuzz_memory_region list and calculate
> total_io_mem/total_ram_mem. This should be done by a separate function.
Yeah, this should just cut-and-paste code from mtree_print_flatview,
then you can remove the printing stuff completely from your copy.
Paolo
- Re: [Qemu-devel] [RFC 05/19] fuzz: expose qemu_savevm_state & skip state header, (continued)
- [Qemu-devel] [RFC 04/19] fuzz: Add qos support to fuzz targets, Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 12/19] fuzz: hard-code all of the needed files for build, Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 09/19] fuzz: use mtree_info to find mapped addresses, Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 10/19] fuzz: expose real_main (aka regular vl.c:main), Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 11/19] fuzz: add direct send/receive in qtest client, Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 14/19] fuzz: hard-code a main-loop timeout, Oleinik, Alexander, 2019/07/24
- [Qemu-devel] [RFC 13/19] fuzz: add ctrl vq support to virtio-net in libqos, Oleinik, Alexander, 2019/07/24